Develop Bugs

[TUTORIAL]How to setup SP_Flash_Tool_Linux (MTK/MediaTek Soc)

This works only on Linux 64-bit
DISCLAIMER: It is always risky to flash your mobile device. I do not and will not take any responsibility for bootloops and bricks.
Please check carefully that the ROM or recovery.img you want to flash is suitable for your specific device and for the sp_flash_tool. The firmware directory should neither contain meta-inf nor system folder, but something_with_a_scatter.txt and a system.img
Backup your phone before flashing!
Your phone's battery should be at least half charged (50 percent) before you start this.
I successfully ran these steps on my UMI Hammer with Linux Ubuntu 14.04 and 16.04. I do not have other devices or Linux derivates and do not plan to buy/install any.
CREDITS and a zillion thanks to Sergio Rivero for his excellent tutorial on mibqyyo.com!!!!
Also many thanks to N2K1 for giving me some more background information!
So here we go:
Step 1:
If you haven't done so before, install the Linux generic usb-drivers package:
Code:
sudo apt-get update
sudo apt install libusb-dev
Download SP Flash Tool Linux (latest version): http://mtk2000.ucoz.ru/load/soft/soft_mtk/sp_flash_tool/5-1-0-14 (Password to extract currently is mtk2000v3)
or here https://androidmtk.com/smart-phone-flash-tool
In case you haven't done before, install unrar:
Code:
sudo apt install unrar
Extract the downloaded file -> graphic file manager (e.g. Nautilus): double-click and extract. Terminal:
Code:
unrar x path_to_file
(from now on: please adapt paths to your own settings)
Move the new folder „sp_flash_tool“ to a directory of your choice.
Code:
mv /home/username/Downloads/sp_flash_tool /home/username/...
You might also need to install libqtwebkit4 (it just happened to me on Linux Ubuntu 16.04):
Code:
sudo apt install libqtwebkit4
[Only For Ubuntu 16.10 and newer]
Run
Code:
dpkg -x libpng12-0_1.2.54-1ubuntu1.1_amd64.deb /tmp/libpng2
cp /tmp/libpng2/lib/x86_64-linux-gnu/libpng12.so.0.54.0 lib
cd lib
ln -s libpng12.so.0.54.0 libpng12.so.0
These libraries are still required for the flash tool but have been removed from new Ubuntu versions.
Thanks @hanalinqu, @z3r0c00l_2k https://forum.xda-developers.com/showpost.php?p=73484473&postcount=216 and @opticyclic https://forum.xda-developers.com/showpost.php?p=81543495&postcount=285 for this information!
Step 2:
Change into the newly created directory:
Code:
cd /sp_flash_tool
We make one file executable by typing:
Code:
chmod +x flash_tool
In order to avoid running the flash_tool as root user, you need to add a standard user to the usergroup "dialout" (thanks to @egalus for this bit!)
Code:
sudo adduser username dialout
For Arch Linux:
Code:
gpasswd -a username uucp
and activate the membership immediately
Code:
newgrp - dialout
(Arch Linux):
Code:
newgrp - uucp
Step 3:
Now you can open the tool:
Code:
./flash_tool
or double-click on the flash_tool icon.
You can try at this stage if the flash tool connects to your phone:
In the user interface, choose tab „Download“. Hit "scatter-loading", navigate to a directory with a valid firmware for your device and choose the scatter-file.
For testing purposes uncheck "name" and check one of the smaller files in the list below (for example "logo")
Switch off your device. Hit the "Download" button in SP_Flash_Tool and connect your phone to the computer. Some devices require you to take off the battery for about 10 seconds, with others you need to press Vol+ or Vol- while plugging the cable into the phone. Please look up device-specific threads and try out different options.
If nothing happens at all, open a second terminal, run
Code:
dmesg | grep usb
and look out for a MediaTek entry. If there is none → did you install libusb-dev (Step 1?)
If the answer is yes, you might need to create a persistent udev rule for the MTK Preloader:
Code:
sudo gedit /etc/udev/rules.d/80-persistent-usb.rules
Add the following line to the file:
Code:
SUBSYSTEM=="usb", ACTION=="add", ATTR{idVendor}=="0e8d", ATTR{idProduct}=="*"
Save the file and exit.
Reload the usb-rules:
Code:
sudo service udev restart
Disconnect the usb data cable from the computer and the smartphone. Close the flash tool. Switch on your phone (fastboot mode will do). Repeat the first paragraph of Step 3.
If the tool connects, within a few seconds a red progress bar will appear. Unfortunately, in my case an error message came along with it:
S_BROM_CMD_JUMP_DA_FAIL (2035)
There is a connection, but also one more obstacle to overcome...
Step 4:
Now we come to the interesting part, which cost me 2 weeks of (futile) research and frustration. Finally I found Sergio Riveros tutorial on mibqyyo. Thanks to him again and again and again for this priceless piece of information
The “modemmanager” package integrated by default within Linux Ubuntu 14.04 and later is not compatible with the MTK Flash Tool for Linux
Click to expand...
Click to collapse
To put it in different words: The modem manager controls port /dev/ttyACM0 and disables the Flash Tool. So we blacklist it for the two MTK vendor IDs the flash tool uses:
Code:
sudo gedit /etc/udev/rules.d/20-mm-blacklist-mtk.rules
You insert these two lines:
Code:
ATTRS{idVendor}=="0e8d", ENV{ID_MM_DEVICE_IGNORE}="1"
ATTRS{idVendor}=="6000", ENV{ID_MM_DEVICE_IGNORE}="1"
Save the file, exit and restart udev:
Code:
sudo service udev restart
Switch your phone on (fastboot mode will suffice) and off again.
Step 5:
Code:
./flash_tool
or double-click on the flash_tool icon.
Now everything should run smoothly. In case you encounter
Code:
BROM ERROR : S_SECURITY_SF_CODE_FORMAT_FORBIDDEN (6012) , MSP ERROE CODE : 0x00
change the download agent to MTK_AllInOne_DA.bin (screenshot #4)
There are plenty of tutorials on the web for the further steps.
Happy flashing! When a green circle with a white checkmark appears, you are done. You can close the flash tool and disconnect your phone. For a clean start with a new ROM boot into recovery and wipe data/factory reset.

Kudos for the udev rules, I finally managed to root my phone and disable some vendor crap thanks to you!

Thanks, I'm glad to read that it worked for you as well

Great post!
Just wanted to say you saved me HOURS OR DAYS OR WEEKS of time on the modemmanager thing. I have Arch Linux, successfully ported over this tutorial, but I had no idea the modemmanager package was causing the issue. SP Flash Tool was the last frontier for using my Android devices on Linux. Thanks so much!

You are very welcome! Since it took me two weeks to find the cause for "S_BROM_Error [2035]" I wanted to spare other "victims" the experience

This is a very nice, HQ post. Keep up the good work.
But I would like to suggest two corrections:
1) The mv command is unnecessary. you don't have to copy the folder to the root directory to run it as root.
2) Please also add a final step to delete the udev rules so as to re-enable the modem manager after rooting.
Though most of the people who would be reading your thread would be knowledgeable linux users, they won't need these suggestions, but anyways, it would make your guide complete.

Thanks for your feedback @daltonfury42
1) Of course you don't need to move to move the folder to / .As I wrote, you can also use your /home/user directory. But you shouldn't keep it in "/Downloads" or "/tmp", since you might have deleted the folder by the next time you want to use the flash-tool.
Step 2), as you suggest it, is redundant on a private computer, because you blacklist the modemmanager for the flash-tool only, and for nothing else. SP_Flash_Tool uses different Vendor and Product IDs than MTP/USB/ADB/Fastboot mode, and these IDs are not related to your specific device. So the modem manager is up and running - even while you flash - on every other active (network-relevant) usb-port of your computer And it will be up and running on the usb-port you use for the flash-tool when you disconnect the phone and then plug in something else - or the same phone in a different mode... But due to the permanent
Code:
/etc/udev/rules.d/20-mm-blacklist-mtk.rules
entry the modem manager will be automatically blocked if you connect your phone to the SP_Flash_Tool a second time - no matter which port: no further preparations necessary
If you want to check it out, take a look the output of
Code:
dmesg | grep usb
connecting your phone "normally" and compare it with the same command -> output connecting your phone to the SP_Flash_Tool - and/or to the contents of the file "usb_setting.xml" in the SP_Flash_Tool directory My udev rule simply tells the modem manager to ignore two vendor IDs named in that file.
edit: if you "flash" your linux computer more often than your Android device, you should remember to backup the folder and the udev rules

Miss Montage said:
Thanks for your feedback @daltonfury42
1) Of course you don't need to move to move the folder to / .As I wrote, you can also use your /home/user directory. But you shouldn't keep it in "/Downloads" or "/tmp", since you might have deleted the folder by the next time you want to use the flash-tool.
Step 2), as you suggest it, is redundant on a private computer, because you blacklist the modemmanager for the flash-tool only, and for nothing else. SP_Flash_Tool uses different Vendor and Product IDs than MTP/USB/ADB/Fastboot mode, and these IDs are not related to your specific device. So the modem manager is up and running - even while you flash - on every other active (network-relevant) usb-port of your computer And it will be up and running on the usb-port you use for the flash-tool when you disconnect the phone and then plug in something else - or the same phone in a different mode... But due to the permanent
Code:
/etc/udev/rules.d/20-mm-blacklist-mtk.rules
entry the modem manager will be automatically blocked if you connect your phone to the SP_Flash_Tool a second time - no matter which port: no further preparations necessary
If you want to check it out, take a look the output of
Code:
dmesg | grep usb
connecting your phone "normally" and compare it with the same command -> output connecting your phone to the SP_Flash_Tool - and/or to the contents of the file "usb_setting.xml" in the SP_Flash_Tool directory My udev rule simply tells the modem manager to ignore two vendor IDs named in that file.
edit: if you "flash" your linux computer more often than your Android device, you should remember to backup the folder and the udev rules
Click to expand...
Click to collapse
@Miss Montage, very informative. Thankyou.

You're welcome - but please do not post full quotes

Hi. Thanks for the tutorial :good:
I'm getting "PMT changed" error with the right scatter when tried to flash bootimg/recovery only.

Where did you get the scatter file? Generally this error code means that the partition table is different to the one on your device. This should only be the case - occasionally - if you flash a complete firmware.
(Or replace Android through Ubuntu / vc. vs.)

Miss Montage said:
Where did you get the scatter file? Generally this error code means that the partition table is different to the one on your device. This should only be the case - here and then - if you flash a complete firmware.
(Or replace Android through Ubuntu / vc. vs.)
Click to expand...
Click to collapse
I know this error, so I am surprised
scatter is from my stock rom. Same i used to flash.

Hmm, dunno why that is. Can you compare the scatter.txt to the /proc/emmc file on your phone?
And at what stage do you get the error? Immediately after connecting or later?

Miss Montage said:
Hmm, dunno why that is. Can you compare the scatter.txt to the /proc/emmc file on your phone?
And at what stage do you get the error? Immediately after connecting or later?
Click to expand...
Click to collapse
Right now I remembered in windows long ago got the same problem.
This happens if I try to use flash sp tool new versions
In windows:
Working: v5.1352.01
Not Working: v5.1512.00.000
Click to expand...
Click to collapse

The sp_flash_tool_linux 5.1520..... worked perfect for me though... Have you tried an earlier version?

Miss Montage said:
The sp_flash_tool_linux 5.1520..... worked perfect for me though... Have you tried an earlier version?
Click to expand...
Click to collapse
SP_Flash_Tool_Linux_v5.1452.00.100 tested, same problem.
SP_Flash_Tool_Linux_v5.1436.00.100 also tested and same.
No older versions found

The version v5.1504.00.100 works on my 64-bit-system, too... But the error seems to be caused by something else. Have you checked the SP logfile?

Have you also tried the newest version? I just involuntarily re-flashed my UMI Hammer with it... Wanted to choose the twrp only, but too much multi-tasking leads to no good

Miss Montage said:
The 32bit-version v5.1504.00.100 works on my 64-bit-system, too... But the error seems to be caused by something else. Have you checked the SP logfile?
Click to expand...
Click to collapse
Tested and same.
Here logs

Hmm, I will compare these lines to a successful log:
08/13/15 23:57:01.942 BROM_DLL[6767][6774]: FlashTool_ReadPartitionInfo(0x7f7b840038a0,0x7f7b84013310,0x7f7b00000013): mutex: LOCK ... (mutex.cpp:151)
08/13/15 23:57:01.942 BROM_DLL[6767][6774]: FlashTool_ReadPartitionInfo(0x7f7b840038a0,0x7f7b84013310,0x7f7b00000013): mutex: UNLOCK. (mutex.cpp:166)
08/13/15 23:57:01.943 BROM_DLL[6767][6774]: FlashTool_Disconnect(0x840038A0): mutex: LOCK ... (mutex.cpp:151)
Click to expand...
Click to collapse

[Tutorial] Install Windows 10 for ARM32 on your Surface 2

Hi guys, following the recent release of a Windows 10 ARM32 install tutorial in Chinese to install it on the Surface RT 1 and Surface RT 2, I've decided to come and try my luck by using google translate to follow the procedure and then decided to refine it and to make it into this tutorial for the Surface 2 (The procedure for the Surface 1 should not be much different aside from the files you have to use but as I don't have one, I haven't tried out the files for it...).
Download: https://yadi.sk/d/mnCUeGKWm1XTXA
Requires:
- The files available in the Yandex Repo
- A recovery USB Disk for Surface 2: Surface2_BMR_20.2.19.0.zip (https://support.microsoft.com/en-hk/help/4023512/surface-creating-and-using-a-usb-recovery-drive)
- A keyboard
1. Copy the following files from the yandex repo to the root directory of your recovery disk:
- Disabling_UAC.reg
- SecureBootPatch.zip (extract it)
- APPX1.rar (extract it)
- surface2_win10_zh_cn_new.wim
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
- Camera_fix.reg
2. Boot into Recovery mode (insert the recovery disk, hold the "vol dow" button then press the "power" button and release the "vol down" button when the surface logo appears)
Open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\sources\install.wim /applydir:c: /index:1
3. Reboot the device and Disable UAC, then run "Disabling_UAC.reg" as admin and reboot the device once again
Once the device has rebooted open regedit and go to "HKEY_LOCAL_MACHINE\BCD00000000" select "BCD00000000", click on file and select "unload hive"
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
4. Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Once in recovery mode open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\surface2_win10_zh_cn_new.wim /applydir:c: /index:1
5. Plugin your keyboard and reboot the device, you should get an error message related to the boot configuration, at this moment press shift+f10 and open regedit
Go to the following registry entry: HKEY_Local machine/SYSTEM/Setup/Status/ChildCompletion and then select the "setup.exe" entry, modify it to "3", exit regedit and commandline and click "Ok" on the error dialog box, the device should reboot(don't reboot the device in any other way), and configure correctly now
Configure the system the way you want it
Once on the desktop open a powershell command prompt and type in the following commands:
- slmgr.vbs /upk
- slmgr /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
- slmgr /skms kms.03k.org
- slmgr /ato
- slmgr /skms zhang.yt
Your device is now activated
6. We must then proceed to install the runtime environment and store app
Select the APPX1 folder and copy it to the Desktop, open it and select "APPX.ps1",and choose "Run with powershell", once done press "enter" reboot the system, go back to where you were and do the same with "AppxBundle.ps1"
Then Select "Microsoft.windowsStore.appxbundle" and install it (this will install a chinese version of the Microsoft Store (better than nothing I guess? Maybe someone can provide and english version?)
Finally install the following files from the root of your recovery disk:
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
7. Now all we need is a few tweaks to remove usability quirks and then your device will work like a shine :
7.1. You might have noticed than when you boot your device you get a message telling you that the licence is about to expire and that you also get a paging file error popping up at every login, this kinda ruins the experience, so we're gonna get rid of those.
- To remove the licensing popup first it go to " C:\Windows\System32" and take ownership of "LicensingUI.exe", then rename it to "LicensingUI-old.exe"
- To remove the paging file popup just manually set the page cache to 16 MB min and 512 MB max.
(Thanks to betanu701 for indicating us these tricks)
7.2. We're also gonna get totally rid of the Chinese language pack to favor any language you might want, this will also change the Store language to whatever language pack you put in.
- Go to Settings>Time & language>Region & language, and then set the whatever language pack you want as the default and remove the Chinese one (that's of course if you don't speak Chinese ^^)
(Thanks to ShotSkydiver for this trick)
7.3. We'll also make the camera work simply by applying the "Camera_fix.reg" registry entry as admin.
Your device is now ready to use.
Bonus: You can download and install the following apps from our fellow community member _CNR_, you'll get a bunch of stock apps that'll work for this build like mail, maps, solitaire...etc and Office 2013, here's the link : https://mega.nz/#F!ivwlHKaZ!hFwEHZnyw_nNTe4b3TN4wA
Quirks: at the moment I am getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
(Edit: the quirks have been ironed out thanks to fellow community members)
I think this is only the beginning, we can probably improve this, first of all, we need an english store app (done), we'll also need to get rid of the error and warnings at every bootup(done), then we'll need to compile some apps and update existing ones and then list them, I hope the community on this forum will be helpful for these tasks :angel: For the time being enjoy what you get

Will this work in Asus winRT?
Enviado desde mi G8441 mediante Tapatalk

notass said:
Will this work in Asus winRT?
Enviado desde mi G8441 mediante Tapatalk
Click to expand...
Click to collapse
No, there are two images available, one made for the Surface 1 and one for the Surface 2, maybe it could work if you make a custom image from the leaked build but certainly not that way...

Hey !
I do have a problem with the "bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on" step... it don't work for me I don't understand why..

Are there any difference in the procedure for the Surface RT, other then using the corresponding W10 image?

Kiba85 said:
Are there any difference in the procedure for the Surface RT, other then using the corresponding W10 image?
Click to expand...
Click to collapse
No difference, if you try, tell me if you can install the secure boot patch and if the command "bcdedit ....." works for you. Because i'm stuck at this step

First off, thanks for the guide; it worked perfectly for my Surface 2! Also, I stumbled across a simple way to get the Store to display in English rather than Chinese: just go into Settings, then Time & language, then Region & language, and then set the English language pack as the default (optionally you can also remove the Chinese language pack as well). From there, open the Store, and it'll be in English!

AlGaib said:
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Click to expand...
Click to collapse
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:

AlGaib said:
Following the recent release of a Windows 10 ARM32 install tutorial in chinese, I've used google translate to follow the procedure and then refined it, here is my tutorial for the Surface 2...
Download: https://yadi.sk/d/mnCUeGKWm1XTXA
Requires:
- The files available in the Yandex Repo
- A recovery USB Disk for Surface 2: Surface2_BMR_20.2.19.0.zip (https://support.microsoft.com/en-hk/help/4023512/surface-creating-and-using-a-usb-recovery-drive)
- A keyboard
Copy the following files from the yandex repo to the root directory of your recovery disk:
- Disabling_UAC.reg
- SecureBootPatch.zip (extract it)
- APPX1.rar (extract it)
- surface2_win10_zh_cn_new.wim
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
Boot into Recovery mode (insert the recovery disk, hold the "vol dow" button then press the "power" button and release the "vol down" button when the surface logo appears)
Open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\sources\install.wim /applydir:c: /index:1
Reboot the device and Disable UAC, then run "Disabling_UAC.reg" as admin and reboot the device once again
Once the device has rebooted open regedit and go to "HKEY_LOCAL_MACHINE\BCD00000000" select "BCD00000000", click on file and select "unload hive"
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Once in recovery mode open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\surface2_win10_zh_cn_new.wim /applydir:c: /index:1
Plugin your keyboard and reboot the device, you should get an error message related to the boot configuration, at this moment press shift+f10 and open regedit
Go to the following registry entry: HKEY_Local machine/SYSTEM/Setup/Status/ChildCompletion and then select the "setup.exe" entry, modify it to "3", exit regedit and commandline and click "Ok" on the error dialog box, the device should reboot(don't reboot the device in any other way), and configure correctly now
Configure the system the way you want it
Once on the desktop open a powershell command prompt and type in the following commands:
- slmgr.vbs /upk
- slmgr /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
- slmgr /skms kms.03k.org
- slmgr /ato
- slmgr /skms zhang.yt
Your device is now activated
We must then proceed to install the runtime environment and store app
Select the APPX1 folder and copy it to the Desktop, open it and select "APPX.ps1",and choose "Run with powershell", once done press "enter" reboot the system, go back to where you were and do the same with "AppxBundle.ps1"
Then Select "Microsoft.windowsStore.appxbundle" and install it (this will install a chinese version of the Microsoft Store (better than nothing I guess? Mybae someone can provide and english version?)
Finally install the following files from the root of your recovery disk:
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
Your device is now ready to use.
Quirks : at the moment I getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
I think this is only the beginning, we can probably improve this, first of all, we need an english store app, we'll also need to get rid of the error and warnings at every bootup, then we'll need to compile some apps and update existing ones and then list them, I hope the community on this forum will be helpful for these tasks :angel: For the time being enjoy what you get
Click to expand...
Click to collapse
To get the Store in english: Start > Settings > Language > Region & Language > Remove chinese
To get rid of the popup (old Windows version): C:\Windows\System32\LogonUI.exe > Right Click > Properties > Security > Advanced > Owner...Change > Add your username > Check Names. Close all popups and rename the file to whatever you want

Do i have to Downgrade to 8.0?

I have a problem. I cant disable Secure Boot. Therefore this command doesn't work:
bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
I already launched SecureBootPatch 100 times. I get the screen on boot where I need to press Agree.
I completely restored with USB recovery Windows 8 RT. Non success
this doesn't change anything. Secureboot stays on.

Avonlady said:
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:
Click to expand...
Click to collapse
Hmmm... are the flash drives formatted to Fat32? I don’t really understand how applying an image could cause this much damage...
Do you get any options when you try to boot into 10? If you can find a way to get to the command line, you can restore a Windows RT image from the restore disk

Evandarkfire said:
I don’t really understand how applying an image could cause this much damage...
Click to expand...
Click to collapse
It's quite simple, really. The sole purpose of SecureBoot is to prevent booting of non-signed operating systems. Like this leaked Windows 10. And since I removed the recovery partition (containing command prompt, etc.), the device is now toast. And yes, the recovery sticks are FAT32.

Avonlady said:
It's quite simple, really. The sole purpose of SecureBoot is to prevent booting of non-signed operating systems. Like this leaked Windows 10. And since I removed the recovery partition (containing command prompt, etc.), the device is now toast. And yes, the recovery sticks are FAT32.
Click to expand...
Click to collapse
Are you sure you booted from usb stick? You should still be able to boot from usb. I broke my efs partition, but could still boot from usb stick and recover everything.

I have to ask and I'm sorry for sounding like a noob..... but will this tutorial work for a Microsoft surface 2 running 8.1rt? I saw theres another post that says windows rt but I'm confused...... also when one of the requirements is a keyboard does that mean a USB keyboard or can the type keyboard work?

Fix quirks
Quirks : at the moment I getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
Click to expand...
Click to collapse
To solve the 2 quirks. For the page caching. Manually set the page cache to min 16 MB and max 512 MB.
For the Build is about the expire. Go to C:\Windows\System32. Find the file LicensingUI.exe. Take complete ownership. Then rename it to LicensingUI-old.exe (or anything).
That will prevent the popups from showing up

Anybody have a working adblocker for the included version of Edge? Also does anybody where to get one of the old UWP arm32 versions of Kodi? They've all been removed from the official servers. Other than that it's amazing, so much better than 8.1!

Avonlady said:
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:
Click to expand...
Click to collapse
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
Cnnrduncan said:
Anybody have a working adblocker for the included version of Edge? Also does anybody where to get one of the old UWP arm32 versions of Kodi? They've all been removed from the official servers. Other than that it's amazing, so much better than 8.1!
Click to expand...
Click to collapse
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...

Will this work if my surface 2 is running 8.1rt?
---------- Post added at 03:00 AM ---------- Previous post was at 02:57 AM ----------
AlGaib said:
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...
Click to expand...
Click to collapse
Would there. E any possible way of making a video tutorial????
---------- Post added at 03:01 AM ---------- Previous post was at 03:00 AM ----------
AlGaib said:
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...
Click to expand...
Click to collapse
Would there. E any possible way of making a video tutorial????

trollingwhovian said:
Will this work if my surface 2 is running 8.1rt?
---------- Post added at 03:00 AM ---------- Previous post was at 02:57 AM ----------
Would there. E any possible way of making a video tutorial????
---------- Post added at 03:01 AM ---------- Previous post was at 03:00 AM ----------
Would there. E any possible way of making a video tutorial????
Click to expand...
Click to collapse
I don't have time or the ressources to do that, sorry, also I don't wanna redo the whole thing again on my device just to make a video tutorial, the text one is good enough...

Root guide (updated)

==== READ THIS POST BEFORE ROOTING ====​https://www.reddit.com/r/surfaceduo/comments/wn5joi/a_warning_to_wouldbe_developers_and_hobbyist/
(ORIGINAL GUIDE BELOW)​Since the last guy hasn't been updating his op, I figured I'd start a fresh thread with what we know and what to do for newcomers.
I will not be posting patched boot images in this thread, I'm a firm believer of "give you steps to follow from the top so you know what's going on and can do this yourself in the future". The more hands we have in the kitchen, the more we learn, and the better we are off as a community.
Walkthroughs for both fresh rooting and updating while rooted are both below:
==== FRESH ROOT ====​
0. make sure USB debugging is on in settings > developer options
0. make sure the phone's bootloader is actually unlocked, if the below doesn't work, back up all the data on your phone because we're about to wipe it
Code:
.\fastboot.exe flashing unlock
.\fastboot.exe flashing unlock_critical
I did both, but it might only require one of the two, if you only did one and it doesn't work you may not be fully unlocked and might have to do the other. Both of these commands from the bootloader will factory reset your phone. if you've already done this, go to step 1.
1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image
2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip
3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools
4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing and used in the below examples)
5. open powershell, and cd to that folder.
6. from the folder, run it like this
Code:
PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin
(this will extract a bunch of stuff, boot.img is all we care about today)
6a. if you don't have python, get it from ninite https://ninite.com/pythonx3/ and go back to step 5/6 and try again, you will likely also need to do a "pip install protobuf" to get the required python libraries for payload-dumper
7. download the latest version of magisk manager (the new magisk app may work, but I've not tested it, this is the exact version I am using on the exact phone you are using. If you feel like trying the app please report in the thread below!) https://github.com/topjohnwu/Magisk/releases/download/manager-v8.0.7/MagiskManager-v8.0.7.apk
8. install magisk manager on your phone
9. make a text file, I called mine magisk_channel.txt and put this in it
Code:
https://raw.githubusercontent.com/Lethany/magisk_files/0755a7d5f596dc2a351270120b31b665fb561294/stable.json
this is the "custom" channel we are using to force an older version of magisk that doesn't choke on our device like newer versions do.
10. use usb data transfer mode to copy the boot.img file we extracted from step 6 and the text file we created in step 8 to your phone's internal storage, I have a folder on the root of the internal storage directory called Z_Phone, but anywhere is fine as long as you know where it is and remember it later.
11. in magisk manager, click the gear in the top right and then select "update channel" > "custom channel"
12. use your duo's dank duo mode to open a file browser on the other screen, open the text file we made in step 9
13. copy and paste the custom channel text into the custom channel field under update channel in magisk so it has the text from step 9 in it. (the text file just saves us typing it out by hand)
14. go back to the magisk main screen, and click install next to "magisk"
14b. click next
14c. click "select and patch a zip file"
14d. browse to the location we uploaded boot.img to in step 9 and select boot.img
14e. click let's go
(this will create the patched boot.img, it'll be named magisk_patched_[some garbage].img)
15. open the internal storage on your PC again, and go to your phone's "downloads" folder, it'll have that patched boot.img (if you've tried this a bunch of times and don't remember which one we just made, feel free to delete all the old ones and do 14-14e again) copy this patched_boot.img to your computer, I just put it in that same folder as step 4
16. in powershell, cd back to that same working folder we've been using and run
Code:
.\adb.exe reboot bootloader
The phone will reboot to the bootloader and we can now try booting the patched image
16. in powershell, run
Code:
.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
17. if your phone boots, that's a great sign and we're out of the woods, nothing else will probably go wrong from here, if it doesn't boot factory reset your phone and start at step 0.
18. open an adb shell prompt and make our boot partitions writable with the below 4 lines, run one by one. Right now we're "rooted" but we've booted off an image over usb, what we really want is to boot off the images on your phone so we need to.
Code:
.\adb.exe shell
su
chmod 777 /dev/block/by-name/boot_a
chmod 777 /dev/block/by-name/boot_b
19. write the patched boot image to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b
(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b
)
20. reboot your phone via the power button menu and if all went well, you're now rooted!
==== UPDATE WHILE ROOTED ====​
1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image
2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip
3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools
4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing)
5. open powershell, and cd to that folder.
6. from the folder, run it like this
Code:
PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin
(this will extract a bunch of stuff, boot.img is all we care about today)
7. boot off of your old magisk patched boot image
Code:
.\adb.exe reboot bootloader
.\fastboot.exe boot ..\[LAST VERSION'S FOLDER]\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
8. write the old, unpatched boot partition to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_b
(my unpatched boot image is in a folder called "Z_Phone" and my unpatched image in this example is called "boot.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/boot of=/dev/block/by-name/boot_b
)
9. reboot
10. run the OTA update on your now freshly stock phone
11. use magisk to patch the new boot image same as in the first root instructions (14a-14e)
12. copy this patched image off of the phone and into our working directory. leave a copy of this on the phone (I put it in my Z_Phone folder)
13. reboot to bootloader (in powershell, in that same working folder we've been using run)
Code:
.\adb.exe reboot bootloader
14. Boot your phone using the patched boot image (in powershell, run)
Code:
.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
15. write the patched boot image to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b
(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b
)
16. reboot and you're updated and rooted!

special thanks to Perseu5 and his original thread!
Unlocking Bootloader/ Magisk Attempt
MAGISK FULL GUIDE (APK for install and other mods coming soon!) The bootloader unlock is pretty similar to any other phone. Go to settings>about> click on build number until developer options are enabled. Go back and select system>Developer...
forum.xda-developers.com

Nice work!

NTchrist said:
special thanks to Perseu5 and his original thread!
Unlocking Bootloader/ Magisk Attempt
MAGISK FULL GUIDE (APK for install and other mods coming soon!) The bootloader unlock is pretty similar to any other phone. Go to settings>about> click on build number until developer options are enabled. Go back and select system>Developer...
forum.xda-developers.com
Click to expand...
Click to collapse
my magisk still shows that theres an update pending for the framework. when i try to patch the stock boot or the custom, it doesnt boot past the windows logo. im guessing the update is for Magisk 21+?

LocBox said:
my magisk still shows that theres an update pending for the framework. when i try to patch the stock boot or the custom, it doesnt boot past the windows logo. im guessing the update is for Magisk 21+?
Click to expand...
Click to collapse
Magisk updates are based on the git channel it's fed. Best guess is you don't have the same git repo as in the guide. If you feed it a repo link to a static version it should never be aware of any updates ever. As far as the app is concerned you're on the latest version.

On vacation until Wed, then I'll push through the new patch and update the guide

update process works successfully and is unchanged from previous versions

update process for 2021.525.62 works successfully and is unchanged from previous versions

This is incredibly helpful! I didn't even know you could unpack the payload.bin lol. I'll be doing some work in the kitchen thanks to this!

For anyone who needs it, here is a patched boot.img for ATT Locked 2021_525_63

nevergrownup said:
For anyone who needs it, here is a patched boot.img for ATT Locked 2021_525_63
Click to expand...
Click to collapse
Can you send the link or tell me how you were able to get the boot.img? When I try to download the factory image from MS, it is still giving me 2021.419.71.
EDIT: The new "Surface Duo - 256GB - Android 10 - ATT - 2021.525.63" recovery image is available on the "Surface Recovery Image Download" page. Thanks nevergrownup for giving me the heads up on Reddit

Is anyone on 2021.525.63 having issues? I've followed the exact guide above, as well as using the newest Magisk version & attempting to boot the patched boot.img just leads my Duo to hang on the Microsoft logo. Just want to see if anyone else has an issue or it's just me.
Thanks.

Veritas06 said:
Is anyone on 2021.525.63 having issues? I've followed the exact guide above, as well as using the newest Magisk version & attempting to boot the patched boot.img just leads my Duo to hang on the Microsoft logo. Just want to see if anyone else has an issue or it's just me.
Thanks.
Click to expand...
Click to collapse
when flashing stock July, my lockscreen keypad is frozen. cant unlock t to use.

LocBox said:
when flashing stock July, my lockscreen keypad is frozen. cant unlock t to use.
Click to expand...
Click to collapse
That's on a fresh install or after flashing the Magisk-modified boot.img?
I'm about to restore with the recovery image & start this again, in case there's some different between OTA & recovery.
EDIT: Doing a factory reset, ADB sideload of the recovery image, creating the new Magisk boot.img, & booting still doesn't work. I'm going to try the guide's version one more time to use the older version of Magisk Manager & the custom channel, but based on previous experience, I'm not hopeful. I only bought this as a device to have fun with because it can be rooted, so I'm regretting this purchase right now =\

Veritas06 said:
That's on a fresh install or after flashing the Magisk-modified boot.img?
I'm about to restore with the recovery image & start this again, in case there's some different between OTA & recovery.
EDIT: Doing a factory reset, ADB sideload of the recovery image, creating the new Magisk boot.img, & booting still doesn't work. I'm going to try the guide's version one more time to use the older version of Magisk Manager & the custom channel, but based on previous experience, I'm not hopeful. I only bought this as a device to have fun with because it can be rooted, so I'm regretting this purchase right now =\
Click to expand...
Click to collapse
I do have the factory unlocked, not the ATT version. In my experience when your lockscreen touch input is not recognized, that happens when either the boot image doesn't match the factory image, or someone has used the factory unlocked boot on an ATT phone or vice-versa.
I'd try a dirty flash of the complete applicable factory images (not just boot/recovery) and then factory reset, then start again from the top. It's possible one of your updates didn't complete or something's become inconsistent between A/B

NTchrist said:
I do have the factory unlocked, not the ATT version. In my experience when your lockscreen touch input is not recognized, that happens when either the boot image doesn't match the factory image, or someone has used the factory unlocked boot on an ATT phone or vice-versa.
I'd try a dirty flash of the complete applicable factory images (not just boot/recovery) and then factory reset, then start again from the top. It's possible one of your updates didn't complete or something's become inconsistent between A/B
Click to expand...
Click to collapse
Thanks. I never even got far enough to see failed touch input, but may try rooting again this weekend. I wasn't able to ever get past the MS logo on boot, after attempting to fastboot boot the Magisk-modified boot.img.

I am in the same boat as Veritas is. My Duo is from ATT and hangs on the Microsoft logo as well. I am very new to rooting and what goes into it so a lot of this stuff I am seeing for the first time. How do I know if I have the correct boot? I went through the whole process of extracting the boot image from the recovery file for my phone off of the Microsoft website. Does that get me the right boot to use?

ThrowARoot said:
I am in the same boat as Veritas is. My Duo is from ATT and hangs on the Microsoft logo as well. I am very new to rooting and what goes into it so a lot of this stuff I am seeing for the first time. How do I know if I have the correct boot? I went through the whole process of extracting the boot image from the recovery file for my phone off of the Microsoft website. Does that get me the right boot to use?
Click to expand...
Click to collapse
It should, yes. Unfortunately I do not have an ATT phone to test against. You'd have to have someone else in the thread confirm it works on the ATT build. About the only thing you can do is boot to stock, and check that settings>about>build number matches the images you downloaded from microsoft (2021.525.62) at time of writing

Actually in checking my settings I noticed there was a new update available, so ignore the build number above just make sure the image you download matches the image on your device

NTchrist said:
Since the last guy hasn't been updating his op, I figured I'd start a fresh thread with what we know and what to do for newcomers.
I will not be posting patched boot images in this thread, I'm a firm believer of "give you steps to follow from the top so you know what's going on and can do this yourself in the future". The more hands we have in the kitchen, the more we learn, and the better we are off as a community.
Walkthroughs for both fresh rooting and updating while rooted are both below:
==== FRESH ROOT ====​
0. make sure USB debugging is on in settings > developer options
0. make sure the phone's bootloader is actually unlocked, if the below doesn't work, back up all the data on your phone because we're about to wipe it
Code:
.\fastboot.exe flashing unlock
.\fastboot.exe flashing unlock_critical
I did both, but it might only require one of the two, if you only did one and it doesn't work you may not be fully unlocked and might have to do the other. Both of these commands from the bootloader will factory reset your phone. if you've already done this, go to step 1.
1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image
2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip
3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools
4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing and used in the below examples)
5. open powershell, and cd to that folder.
6. from the folder, run it like this
Code:
PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin
(this will extract a bunch of stuff, boot.img is all we care about today)
6a. if you don't have python, get it from ninite https://ninite.com/pythonx3/ and go back to step 5/6 and try again
7. download the latest version of magisk manager (the new magisk app may work, but I've not tested it, this is the exact version I am using on the exact phone you are using. If you feel like trying the app please report in the thread below!) https://github.com/topjohnwu/Magisk/releases/download/manager-v8.0.7/MagiskManager-v8.0.7.apk
8. install magisk manager on your phone
9. make a text file, I called mine magisk_channel.txt and put this in it
Code:
https://raw.githubusercontent.com/Lethany/magisk_files/0755a7d5f596dc2a351270120b31b665fb561294/stable.json
this is the "custom" channel we are using to force an older version of magisk that doesn't choke on our device like newer versions do.
10. use usb data transfer mode to copy the boot.img file we extracted from step 6 and the text file we created in step 8 to your phone's internal storage, I have a folder on the root of the internal storage directory called Z_Phone, but anywhere is fine as long as you know where it is and remember it later.
11. in magisk manager, click the gear in the top right and then select "update channel" > "custom channel"
12. use your duo's dank duo mode to open a file browser on the other screen, open the text file we made in step 9
13. copy and paste the custom channel text into the custom channel field under update channel in magisk so it has the text from step 9 in it. (the text file just saves us typing it out by hand)
14. go back to the magisk main screen, and click install next to "magisk"
14b. click next
14c. click "select and patch a zip file"
14d. browse to the location we uploaded boot.img to in step 9 and select boot.img
14e. click let's go
(this will create the patched boot.img, it'll be named magisk_patched_[some garbage].img)
15. open the internal storage on your PC again, and go to your phone's "downloads" folder, it'll have that patched boot.img (if you've tried this a bunch of times and don't remember which one we just made, feel free to delete all the old ones and do 14-14e again) copy this patched_boot.img to your computer, I just put it in that same folder as step 4
16. in powershell, cd back to that same working folder we've been using and run
Code:
.\adb.exe reboot bootloader
The phone will reboot to the bootloader and we can now try booting the patched image
16. in powershell, run
Code:
.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
17. if your phone boots, that's a great sign and we're out of the woods, nothing else will probably go wrong from here, if it doesn't boot factory reset your phone and start at step 0.
18. open an adb shell prompt and make our boot partitions writable with the below 4 lines, run one by one. Right now we're "rooted" but we've booted off an image over usb, what we really want is to boot off the images on your phone so we need to.
Code:
.\adb.exe shell
su
chmod 777 /dev/block/by-name/boot_a
chmod 777 /dev/block/by-name/boot_b
19. write the patched boot image to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b
(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b
)
20. reboot your phone via the power button menu and if all went well, you're now rooted!
==== UPDATE WHILE ROOTED ====​
1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image
2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip
3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools
4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing)
5. open powershell, and cd to that folder.
6. from the folder, run it like this
Code:
PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin
(this will extract a bunch of stuff, boot.img is all we care about today)
7. boot off of your old magisk patched boot image
Code:
.\adb.exe reboot bootloader
.\fastboot.exe boot ..\[LAST VERSION'S FOLDER]\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
8. write the old, unpatched boot partition to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_b
(my unpatched boot image is in a folder called "Z_Phone" and my unpatched image in this example is called "boot.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/boot of=/dev/block/by-name/boot_b
)
9. reboot
10. run the OTA update on your now freshly stock phone
11. use magisk to patch the new boot image same as in the first root instructions (14a-14e)
12. copy this patched image off of the phone and into our working directory. leave a copy of this on the phone (I put it in my Z_Phone folder)
13. reboot to bootloader (in powershell, in that same working folder we've been using run)
Code:
.\adb.exe reboot bootloader
14. Boot your phone using the patched boot image (in powershell, run)
Code:
.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img
15. write the patched boot image to your boot partitions with the below lines, again run one by one
Code:
adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b
(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:
Code:
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b
)
16. reboot and you're updated and rooted!
Click to expand...
Click to collapse
Ok I am not sure what I am doing wrong and before anyone says anything is not my first or 10th phone I have rooted, first the so called image that you download from Microsoft is nothing but folders of useless text docs. and the patched magisk image in this thread says it works. I went through the whole set up it says the boot image was successfully done yet upon rebooting my device is not rooted. Can anyone help with this.

OnePlus 5T black screen with white light after flashing GSI

Hello Hello, so, I wanted to try out the newest stuff in the android world, android 12. But I was quite aware that it wouldn't be available for my old OP5T for a while. After reading the google page about the beta I found out about GSIs and to my surprise, my OnePlus 5T has treble support.
I tried flashing it with this guide: https://source.android.com/setup/build/gsi the first issue I hit was the so-called "vbmeta" partition. My phone does not seem to have one. I continued anyway and successfully flashed the image to the system partition. Now after rebooting my phone is stuck at a black screen with white light. I also googled for that but didn't find any top hits related to GSIs. I also tried to flash the img via twrp.
The image I tried: gsi_gms_arm64-exp-SPB1.210331.013-7333779-0cf2eba2.zip downloaded from https://developer.android.com/about/versions/12/gsi-release-notes#downloads
I also tried lineage os because... well I thought it might just be the image but the same result: https://sourceforge.net/projects/andyyan-gsi/files/lineage-18.x/
Is there any way to get on some logs at this stage in the boot process or do any of you guys just know what is wrong?

With your device attached to Wiindows computer, from the Windows command-line ( where ADB is accessible ) you might run:
Code:
adb devices
adb bugreport > C:\bugreport.zip
This will generate a zipped text file with the above name in the C: drive, which you can then unpack and examine. Be patient, it may take 10 seconds or more to generate the file.

jwoegerbauer said:
With your device attached to Wiindows computer, from the Windows command-line ( where ADB is accessible ) you might run:
Code:
adb devices
adb bugreport > C:\bugreport.zip
This will generate a zipped text file with the above name in the C: drive, which you can then unpack and examine. Be patient, it may take 10 seconds or more to generate the file.
Click to expand...
Click to collapse
Weill, I assume the phone has to be running for that? It obviously doesn't rn. I can get it into recovery but the output is just:
Code:
Failed to get bugreportz version: 'bugreportz -v' returned '' (code 127).
If the device does not run Android 7.0 or above, try 'adb bugreport' instead.
I also used Linux not windows, but that should hopefully not be an issue

How To Guide [GUIDE] Change Splash screen for this phone!

NOTE: I am not responsible for any bricked devices. DO THIS AT YOUR OWN RISK!
Click to expand...
Click to collapse
I recently changed my splash screen logo from samsung to a custom one i made in pixlr. Its looks coool. A video is attached below.
REQUIREMENTS:
- ROOTED A32 4G
- usb c cable (to connect to pc)
- windows PC (for zipping and etc.)
- ADB installed on your pc. (For running shell commands) [OR YOU COULD USE SOME TERMINAL EMULATOR]
If your doing this on your phone just follow along, i included seperate commands.
STEPS:
1. Download attached up_param.bin (i extracted this from android 11 firmware. it shld work with fine with 12 they are same. Since downloading whole firmware takes alot of time)
2. Install 7zip if you already didn't from here.
3. Make a working directory anywhere
4. Use 7 zip to extract up_param.bin to a folder.
After extracting this is what you should see
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
These are all the images!
5. modify files as you like. (MAKE SURE THE DIMENSIONS ARE THE SAME. AND DO NOT REMOVE ANY IMAGE IT COULD BRICK)
NOTE: DO NOT TOUCH DOWNLOAD MODE IMAGES. if you f**k them up you will never be able to get into download mode again
You can replace boot_warning.jpg, logo.jpg (main file responsible logo), letter.jpg (the logo that shows for a split second), svb_orange.jpg (boot loader unlock warning)
6. select all images -> right click -> add to archive.
7. set it to tar.
8. set compression method to GNU.
This is what it should look like
9. Click on OK.
10. Now connect your A32 to the PC. (enable USB debugging)
11. Copy over the tar file that was generated by 7zip to anywhere. i am gonna assume we placed it in the internal storage (/sdcard/)
12. Run the following commands.
NOTE: I am editing the original thread since i checked in up param file of my new a13 fw and found new file. Its for if the battery temperature is too high. if you modify the up param from a11 fw and flash that it may not exist and the phone will boot loop if it wants to display the menu...
iM UPLOADING A13 stock up_param HERE FROM A325FXXU2CVK3.
Uploaded as up_param-a13.bin
adb shell (Phone users skip this.)
su
(Grant su permission if the popup comes up).
Then run
ls -l /dev/block/platform/****/by-name
After you get a long output. Search for up_param.
(We all have the same phone but just in case some people with diff samsung mtk phones come here).
now we just have to run 2 more commands and we are done!
Taking backups incase something goes wrong.
(People with different phones replace your up_param partition name here.)
dd if=/dev/block/mmcblk0p35 of=/sdcard/backup-param.bin
Now flashing our new modified up_param with new images
dd if=/sdcard/filename.tar of=/dev/block/mmcblk0p35
WE ARE DONE! now reboot and enjoy the new logo!

CREDITS:
- Orignal post: here.
Also video attached below

Captain_cookie_200 said:
I recently changed my splash screen logo from samsung to a custom one i made in pixlr. Its looks coool. A video is attached below.
REQUIREMENTS:
- ROOTED A32 4G
- usb c cable (to connect to pc)
- windows PC (for zipping and etc.)
- ADB installed on your pc. (For running shell commands) [OR YOU COULD USE SOME TERMINAL EMULATOR]
If your doing this on your phone just follow along, i included seperate commands.
STEPS:
1. Download attached up_param.bin (i extracted this from android 11 firmware. it shld work with fine with 12 they are same. Since downloading whole firmware takes alot of time)
2. Install 7zip if you already didn't from here.
3. Make a working directory anywhere
4. Use 7 zip to extract up_param.bin to a folder.
After extracting this is what you should see
View attachment 5775661
These are all the images!
5. modify files as you like. (MAKE SURE THE DIMENSIONS ARE THE SAME. AND DO NOT REMOVE ANY IMAGE IT COULD BRICK)
NOTE: DO NOT TOUCH DOWNLOAD MODE IMAGES. if you f**k them up you will never be able to get into download mode again
You can replace boot_warning.jpg, logo.jpg (main file responsible logo), letter.jpg (the logo that shows for a split second), svb_orange.jpg (boot loader unlock warning)
6. select all images -> right click -> add to archive.
View attachment 5775663
7. set it to tar.
8. set compression method to GNU.
This is what it should look like
View attachment 5775665
9. Click on OK.
10. Now connect your A32 to the PC. (enable USB debugging)
11. Copy over the tar file that was generated by 7zip to anywhere. i am gonna assume we placed it in the internal storage (/sdcard/)
12. Run the following commands.
adb shell (Phone users skip this.)
su
(Grant su permission if the popup comes up).
Then run
ls -l /dev/block/platform/****/by-name
After you get a long output. Search for up_param.
View attachment 5775673
(We all have the same phone but just in case some people with diff samsung mtk phones come here).
now we just have to run 2 more commands and we are done!
Taking backups incase something goes wrong.
(People with different phones replace your up_param partition name here.)
dd if=/dev/block/mmcblk0p35 of=/sdcard/backup-param.bin
Now flashing our new modified up_param with new images
dd if=/sdcard/filename.tar of=/dev/mmcblk0p35
WE ARE DONE! now reboot and enjoy the new logo!
Click to expand...
Click to collapse
Very good thanks

kilam9900 said:
Very good thanks
Click to expand...
Click to collapse
hehe your welcome. hope it works epikly for you. (if you do it)

Captain_cookie_200 said:
hehe your welcome. hope it works epikly for you. (if you do it)
Click to expand...
Click to collapse
I will do it but I am scare to f**k size so I will do it on PC

kilam9900 said:
I will do it but I am scare to f**k size so I will do it on PC
Click to expand...
Click to collapse
oh lmao. if you do end up breaking your up_param it would still boot fine. but downlaod mode would break until a proper up param file is flashed again.

Captain_cookie_200 said:
oh lmao. if you do end up breaking your up_param it would still boot fine. but downlaod mode would break until a proper up param file is flashed again.
Click to expand...
Click to collapse
I'm reassured

I recommend using dd oflag=direct,sync if=/sdcard/filename.tar of=/dev/block/mmcblk[...] otherwise you may get all sorts of problems, even a bricked phone, especially if you reboot straightaway after flashing. Inside Android all data transfers are cached, it's not the Download tool where everything is synchronous (or at least flushed before reboot).

uluruman said:
I recommend using dd oflag=direct,sync if=/sdcard/filename.tar of=/dev/block/mmcblk[...] otherwise you may get all sorts of problems, even a bricked phone, especially if you reboot straightaway after flashing. Inside Android all data transfers are cached, it's not the Download tool where everything is synchronous (or at least flushed before reboot).
Click to expand...
Click to collapse
i didnt have to deal with anything like that. i did multiple flashes atleast 15 flashes using dd to the up param partition and i did not brick my phone at all. worse you could get is a black screen while booting. and your download mode would not work. but its easy to get it back just flash the up param file again the one that was backed up. although thanks for the info. i did this using recovery. could also be done while booted into android itself

Captain_cookie_200 said:
i didnt have to deal with anything like that. i did multiple flashes atleast 15 flashes using dd to the up param partition and i did not brick my phone at all. worse you could get is a black screen while booting. and your download mode would not work. but its easy to get it back just flash the up param file again the one that was backed up. although thanks for the info. i did this using recovery. could also be done while booted into android itself
Click to expand...
Click to collapse
I ran into this problem when rebooted the phone using the "reboot" shell command right after the "dd". When rebooting from the UI all caches are flushed, of course, but the "reboot" command is a bit crude method I suppose (although in Linux it's always absolutely graceful). Anyway, the logo screen looked absolutely fine, and the system booted okay, but when I tried to enter Download I got the black screen and the boot loop, and no way to either enter Download, Recovery or boot the system. In fact the only thing that still worked was forced reboot (Power + Vol Down). I was able to get out of this situation by connecting the charger and holding Power + Vol Down to force the phone into the off state, then I connected it to the PC and tried entering the Download mode once again, and this time it worked although the graphics was all messed up.

uluruman said:
I ran into this problem when rebooted the phone using the "reboot" shell command right after the "dd". When rebooting from the UI all caches are flushed, of course, but the "reboot" command is a bit crude method I suppose (although in Linux it's always absolutely graceful). Anyway, the logo screen looked absolutely fine, and the system booted okay, but when I tried to enter Download I got the black screen and the boot loop, and no way to either enter Download, Recovery or boot the system. In fact the only thing that still worked was forced reboot (Power + Vol Down). I was able to get out of this situation by connecting the charger and holding Power + Vol Down to force the phone into the off state, then I connected it to the PC and tried entering the Download mode once again, and this time it worked although the graphics was all messed up.
Click to expand...
Click to collapse
did you touch the download mode images in any way? i dont know why this happened for you. i guess i did press the reboot button instead of using the command. since i do it on first fw reflash and i flash a gsi immdiiately afterwards... download shouldnt have died like that tho. i messed with my down load images completely. i competely replaced them with diff new images that are diff sizes too. i dont know why this is happening for you. my download works fine. although it reverts to the old download image somehow once on downloading mode. for confirmations it does show my edited images.

Captain_cookie_200 said:
did you touch the download mode images in any way? i dont know why this happened for you. i guess i did press the reboot button instead of using the command. since i do it on first fw reflash and i flash a gsi immdiiately afterwards... download shouldnt have died like that tho. i messed with my down load images completely. i competely replaced them with diff new images that are diff sizes too. i dont know why this is happening for you. my download works fine. although it reverts to the old download image somehow once on downloading mode. for confirmations it does show my edited images.
Click to expand...
Click to collapse
I suppose your Download still worked fine because the up_param tar archive was complete and not corrupt, and even image files were normal and not chopped in the middle of the data stream. In my case it was the latter, when cache is not flushed the data stream is just cut, and such a simple program as Download obviously cannot handle broken files. The Download tool itself is kept in the separate "debugger" flash memory, I guess it has the default graphics too which can be displayed if no graphics is found in up_param.

uluruman said:
I suppose your Download still worked fine because the up_param tar archive was complete and not corrupt, and even image files were normal and not chopped in the middle of the data stream. In my case it was the latter, when cache is not flushed the data stream is just cut, and such a simple program as Download obviously cannot handle broken files.
Click to expand...
Click to collapse
oh i see. thanks for telling about this. it would help people alot from preventing to brick their phone from bricking

Captain_cookie_200 said:
oh i see. thanks for telling about this. it would help people alot from preventing to brick their phone from bricking
Click to expand...
Click to collapse
Correction: 'dd oflag=direct,sync' does not work in Android shell, the working alternative is 'dd conv=fsync'

Captain_cookie_200 said:
I recently changed my splash screen logo from samsung to a custom one i made in pixlr. Its looks coool. A video is attached below.
REQUIREMENTS:
- ROOTED A32 4G
- usb c cable (to connect to pc)
- windows PC (for zipping and etc.)
- ADB installed on your pc. (For running shell commands) [OR YOU COULD USE SOME TERMINAL EMULATOR]
If your doing this on your phone just follow along, i included seperate commands.
STEPS:
1. Download attached up_param.bin (i extracted this from android 11 firmware. it shld work with fine with 12 they are same. Since downloading whole firmware takes alot of time)
2. Install 7zip if you already didn't from here.
3. Make a working directory anywhere
4. Use 7 zip to extract up_param.bin to a folder.
After extracting this is what you should see
View attachment 5775661
These are all the images!
5. modify files as you like. (MAKE SURE THE DIMENSIONS ARE THE SAME. AND DO NOT REMOVE ANY IMAGE IT COULD BRICK)
NOTE: DO NOT TOUCH DOWNLOAD MODE IMAGES. if you f**k them up you will never be able to get into download mode again
You can replace boot_warning.jpg, logo.jpg (main file responsible logo), letter.jpg (the logo that shows for a split second), svb_orange.jpg (boot loader unlock warning)
6. select all images -> right click -> add to archive.
View attachment 5775663
7. set it to tar.
8. set compression method to GNU.
This is what it should look like
View attachment 5775665
9. Click on OK.
10. Now connect your A32 to the PC. (enable USB debugging)
11. Copy over the tar file that was generated by 7zip to anywhere. i am gonna assume we placed it in the internal storage (/sdcard/)
12. Run the following commands.
NOTE: I am editing the original thread since i checked in up param file of my new a13 fw and found new file. Its for if the battery temperature is too high. if you modify the up param from a11 fw and flash that it may not exist and the phone will boot loop if it wants to display the menu...
iM UPLOADING A13 stock up_param HERE FROM A325FXXU2CVK3.
Uploaded as up_param-a13.bin
adb shell (Phone users skip this.)
su
(Grant su permission if the popup comes up).
Then run
ls -l /dev/block/platform/****/by-name
After you get a long output. Search for up_param.
View attachment 5775673
(We all have the same phone but just in case some people with diff samsung mtk phones come here).
now we just have to run 2 more commands and we are done!
Taking backups incase something goes wrong.
(People with different phones replace your up_param partition name here.)
dd if=/dev/block/mmcblk0p35 of=/sdcard/backup-param.bin
Now flashing our new modified up_param with new images
dd if=/sdcard/filename.tar of=/dev/block/mmcblk0p35
WE ARE DONE! now reboot and enjoy the new logo!
Click to expand...
Click to collapse
NOTE: I am editing the original thread since i checked in up param file of my new a13 fw and found new file. Its for if the battery temperature is too high. if you modify the up param from a11 fw and flash that it may not exist and the phone will boot loop if it wants to display the menu...
iM UPLOADING A13 stock up_param HERE FROM A325FXXU2CVK3.
Uploaded in orignal thread as up_param-a13.bin

I made it and works perfectly, thanks for the tutorial!!

ApiYoshi said:
I made it and works perfectly, thanks for the tutorial!!
Click to expand...
Click to collapse
glad to hear thatt. and your welcome

how to apply this on snapdragon devices
they don't have up_parem.bin file ??

elswerky said:
how to apply this on snapdragon devices
they don't have up_parem.bin file ??
Click to expand...
Click to collapse
they do? check inside bl file of your firmware. Or using the partition list command should show it

Captain_cookie_200 said:
they do? check inside bl file of your firmware. Or using the partition list command should show it
Click to expand...
Click to collapse
Bl file itself doesn't have up_parem.bin file
Unlike exynis devices which have it
And am.nit familiar with partition as you said if you can helping me
Talking about tab S6 w8th android 12 , OneUi 4.1